clawbot
fc651abe46
check / check (push) Successful in 4m39s
Unset or empty, TRUSTED_PROXIES now defaults to 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, so a reverse proxy reaching the app over a Docker network or a private LAN gets per-client rate-limit buckets without configuration. A set value replaces the default; an unparseable one still fails startup. The startup warning for an empty list goes, with its test hook and test, since the default is no longer empty. The README's configuration table, Trusted proxies, upaas and reverse-proxy sections describe the new default and when to narrow it to the proxy alone. Model: opus-5-5
60 lines
1.9 KiB
Go
60 lines
1.9 KiB
Go
package config
|
|
|
|
import "log/slog"
|
|
|
|
// This file exposes the unexported environment parsing helpers to
|
|
// the external config_test package so each helper can be covered by
|
|
// its own table-driven test without weakening the package API.
|
|
|
|
// WarnEgressAllowlistForTest loads a Config from the current
|
|
// environment and emits its egress-allowlist startup warning to
|
|
// log, so a test can assert both that the warning fires only when
|
|
// the list is non-empty and that it names the blocks it opened.
|
|
func WarnEgressAllowlistForTest(log *slog.Logger) error {
|
|
c, err := loadFromEnv()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
c.warnEgressAllowlist(log)
|
|
|
|
return nil
|
|
}
|
|
|
|
// EnvBoolForTest exposes envBool.
|
|
func EnvBoolForTest(key string, defaultValue bool) (bool, error) {
|
|
return envBool(key, defaultValue)
|
|
}
|
|
|
|
// EnvPositiveIntForTest exposes envPositiveInt.
|
|
func EnvPositiveIntForTest(key string, defaultValue int) (int, error) {
|
|
return envPositiveInt(key, defaultValue)
|
|
}
|
|
|
|
// EnvPortForTest exposes envPort.
|
|
func EnvPortForTest(key string, defaultValue int) (int, error) {
|
|
return envPort(key, defaultValue)
|
|
}
|
|
|
|
// EnvSentryDSNForTest exposes envSentryDSN.
|
|
func EnvSentryDSNForTest(key string) (string, error) {
|
|
return envSentryDSN(key)
|
|
}
|
|
|
|
// LoadDotEnvFileForTest exposes the loader LoadDotEnv runs, over a
|
|
// caller-named file rather than the process working directory, so
|
|
// each .env state can be covered without moving the test process.
|
|
func LoadDotEnvFileForTest(path string) error {
|
|
return loadDotEnvFile(path)
|
|
}
|
|
|
|
// EnvBindAddressForTest exposes envBindAddress.
|
|
func EnvBindAddressForTest(key, defaultValue string) (string, error) {
|
|
return envBindAddress(key, defaultValue)
|
|
}
|
|
|
|
// DefaultBindAddressForTest exposes the compiled-in BIND_ADDRESS
|
|
// default, so a test pins the documented value rather than repeating
|
|
// a literal that could drift from it.
|
|
const DefaultBindAddressForTest = defaultBindAddress
|